fix: enforce path boundary in built-in agent file tools and restrict YAML callback invocation

[adilburaksen]

Summary

This PR fixes two security issues in the Agent Builder Assistant's file tools and YAML agent config loading.

Fix 1 — Path boundary enforcement in resolve_file_path() (resolve_root_directory.py)

Issue: resolve_file_path() accepted absolute paths without checking whether they were within the project root, and trusted root_directory from session state without validation. This allowed file operations outside the intended project directory.

Fix:

• Add _validate_root_directory() that rejects absolute paths, null bytes, backslashes, and .. components in session-state-supplied root_directory (mirrors the same pattern applied in commit cbcb5e6 for file_artifact_service.py)
• After resolving the final path, enforce project root boundary using .relative_to() for both absolute and relative inputs

Fix 2 — Restrict callable invocation in resolve_code_reference() (config_agent_utils.py)

Issue: resolve_code_reference() called any Python callable with attacker-supplied args from YAML config at deserialization time. This allowed specifying dangerous built-ins (e.g. os.system) as callbacks with arbitrary arguments.

Fix: Only invoke a callable with args when the resolved object is a class constructor (inspect.isclass()). Plain functions cannot be called with args from YAML config; they are returned as references for the framework to invoke at the appropriate time.

Testing

Both fixes are verified with unit tests confirming:

• Absolute paths are blocked
• root_directory: "/" injection is blocked
• Legitimate relative paths continue to work
• os.system and other non-class callables with args are blocked in YAML config